chainlesschain 0.166.100 → 0.166.102

package/src/lib/formal-budget-transport.js

@@ -0,0 +1,345 @@
+import {
+  budgetError,
+  canonical,
+  requireBudget,
+} from "./formal-budget-contract.js";
+
+export const FORMAL_BUDGET_RUNTIME_READINESS = Object.freeze({
+  paidReady: false,
+  reason:
+    "Agent, Chat, compaction, advisor, probes, retries and child-process egress are not yet all routed through this authority",
+});
+export function requireFormalBudgetRuntime() {
+  throw budgetError(
+    "CC_BUDGET_RUNTIME_NOT_COVERED",
+    FORMAL_BUDGET_RUNTIME_READINESS.reason,
+  );
+}
+
+// JSON.parse alone accepts duplicate keys (including escaped aliases) and
+// overflows numeric literals to Infinity. Neither is safe accounting evidence.
+export function parseBudgetJson(text) {
+  requireBudget(typeof text === "string", "JSON text required");
+  let at = 0;
+  const whitespace = () => {
+    while (at < text.length && /[\x20\t\r\n]/u.test(text[at])) at++;
+  };
+  function string() {
+    requireBudget(text[at] === '"', "JSON string expected");
+    const start = at++;
+    while (at < text.length) {
+      const char = text[at++];
+      if (char === '"') return JSON.parse(text.slice(start, at));
+      if (char === "\\") at++;
+    }
+    requireBudget(false, "Unterminated JSON string");
+  }
+  function value(depth) {
+    requireBudget(depth <= 64, "JSON nesting exceeds accounting parser bound");
+    whitespace();
+    if (text[at] === '"') {
+      string();
+      return;
+    }
+    if (text[at] === "{") {
+      at++;
+      whitespace();
+      const keys = new Set();
+      if (text[at] === "}") {
+        at++;
+        return;
+      }
+      for (;;) {
+        whitespace();
+        const key = string();
+        requireBudget(
+          !keys.has(key),
+          "Duplicate JSON member in provider evidence",
+        );
+        keys.add(key);
+        whitespace();
+        requireBudget(text[at++] === ":", "JSON member separator expected");
+        value(depth + 1);
+        whitespace();
+        const separator = text[at++];
+        if (separator === "}") return;
+        requireBudget(separator === ",", "JSON object separator expected");
+      }
+    }
+    if (text[at] === "[") {
+      at++;
+      whitespace();
+      if (text[at] === "]") {
+        at++;
+        return;
+      }
+      for (;;) {
+        value(depth + 1);
+        whitespace();
+        const separator = text[at++];
+        if (separator === "]") return;
+        requireBudget(separator === ",", "JSON array separator expected");
+      }
+    }
+    for (const literal of ["true", "false", "null"])
+      if (text.startsWith(literal, at)) {
+        at += literal.length;
+        return;
+      }
+    const number = text
+      .slice(at)
+      .match(/^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/u)?.[0];
+    requireBudget(
+      number && Number.isFinite(Number(number)),
+      "Invalid or non-finite JSON number",
+    );
+    at += number.length;
+  }
+  value(0);
+  whitespace();
+  requireBudget(at === text.length, "Trailing JSON input");
+  return JSON.parse(text);
+}
+
+/** Allowlist only; the caller must still supply the existing OS sandbox. */
+export function formalBudgetTaskEnvironment(environment = process.env) {
+  return Object.fromEntries(
+    [
+      "PATH",
+      "Path",
+      "SystemRoot",
+      "SYSTEMROOT",
+      "WINDIR",
+      "ComSpec",
+      "PATHEXT",
+      "TEMP",
+      "TMP",
+      "TMPDIR",
+      "LANG",
+      "LC_ALL",
+      "LC_CTYPE",
+    ]
+      .filter((key) => typeof environment[key] === "string")
+      .map((key) => [key, environment[key]]),
+  );
+}
+
+async function boundedText(response, maximumBytes) {
+  requireBudget(response.body?.getReader, "Response body unavailable");
+  const reader = response.body.getReader(),
+    chunks = [];
+  let size = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      requireBudget(
+        size <= maximumBytes,
+        "Provider response exceeded bounded parser",
+      );
+      chunks.push(Buffer.from(value));
+    }
+  } catch (error) {
+    try {
+      await reader.cancel();
+    } catch {
+      /* keep original unknown outcome */
+    }
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+  return new TextDecoder("utf-8", { fatal: true }).decode(
+    Buffer.concat(chunks),
+  );
+}
+function streamReceipt(text) {
+  let terminal = false,
+    receipt = null,
+    usage = null,
+    finishReason = null;
+  for (const frame of text.replaceAll("\r\n", "\n").split("\n\n")) {
+    if (!frame.trim()) continue;
+    const data = frame
+      .split("\n")
+      .filter((line) => line.startsWith("data:"))
+      .map((line) => line.slice(5).trimStart())
+      .join("\n");
+    if (!data) continue;
+    requireBudget(!terminal, "Unexpected stream data after terminal marker");
+    if (data === "[DONE]") {
+      requireBudget(
+        finishReason !== null,
+        "Stream ended without a completed choice",
+      );
+      terminal = true;
+      continue;
+    }
+    const row = parseBudgetJson(data);
+    requireBudget(row && !Object.hasOwn(row, "error"), "Provider stream error");
+    const identity = {
+      id: row.id,
+      model: row.model,
+      service_tier: row.service_tier,
+    };
+    if (!receipt) receipt = identity;
+    else {
+      // Some providers only send service_tier on the final usage frame.
+      requireBudget(
+        row.id === receipt.id && row.model === receipt.model,
+        "Stream identity changed",
+      );
+      if (row.service_tier !== undefined) {
+        requireBudget(
+          receipt.service_tier === undefined ||
+            row.service_tier === receipt.service_tier,
+          "Stream tier changed",
+        );
+        receipt.service_tier = row.service_tier;
+      }
+    }
+    requireBudget(
+      Array.isArray(row.choices) &&
+        row.choices.length <= 1 &&
+        row.choices.every((choice) => choice.index === 0),
+      "Multiple/unknown streamed completions",
+    );
+    for (const choice of row.choices) {
+      requireBudget(
+        finishReason === null,
+        "Choice data received after completed stream choice",
+      );
+      if (choice.finish_reason != null) {
+        requireBudget(
+          ["stop", "length", "tool_calls"].includes(choice.finish_reason),
+          "Unsupported stream finish reason",
+        );
+        finishReason = choice.finish_reason;
+      }
+    }
+    if (row.usage != null) {
+      requireBudget(
+        finishReason !== null,
+        "Usage received before complete stream choice",
+      );
+      requireBudget(
+        usage === null || canonical(usage) === canonical(row.usage),
+        "Conflicting streamed usage",
+      );
+      usage = row.usage;
+    }
+  }
+  requireBudget(
+    terminal && finishReason !== null && receipt && usage,
+    "Incomplete stream or missing usage",
+  );
+  return { ...receipt, usage };
+}
+
+/**
+ * Trusted-host JSON/SSE transport: credential stays in this closure, and every
+ * physical request consumes a durable dispatch exactly once. No auto retries.
+ * This is not the unrestricted Agent/Chat transport and is not auto-enabled.
+ */
+export function createFormalBudgetTransport({
+  authority,
+  credentialProvider,
+  fetchImpl = globalThis.fetch,
+  maximumResponseBytes = 16 * 1024 * 1024,
+  timeoutMs = 60_000,
+}) {
+  requireBudget(
+    authority &&
+      typeof credentialProvider === "function" &&
+      typeof fetchImpl === "function",
+    "Authority and trusted credential provider required",
+  );
+  requireBudget(
+    Number.isSafeInteger(maximumResponseBytes) &&
+      maximumResponseBytes > 0 &&
+      maximumResponseBytes <= 16 * 1024 * 1024,
+    "Invalid response byte bound",
+  );
+  requireBudget(
+    Number.isSafeInteger(timeoutMs) && timeoutMs > 0 && timeoutMs <= 300_000,
+    "Invalid timeout",
+  );
+  return Object.freeze({
+    async dispatch({ runId, callId, body, signal }) {
+      // Snapshot before await so caller mutation cannot alter the reserved body.
+      const request = JSON.parse(canonical(body));
+      authority.reserve({ runId, callId, body: request });
+      let settled = false;
+      try {
+        const reserved = authority.reservedContract(callId);
+        const credential = await credentialProvider({
+          contractId: reserved.id,
+          provider: reserved.provider,
+          endpoint: reserved.endpoint,
+        });
+        requireBudget(
+          typeof credential === "string" &&
+            credential.length > 0 &&
+            !/[\r\n]/u.test(credential),
+          "Credential unavailable",
+        );
+        const deadline = AbortSignal.timeout(timeoutMs);
+        const options = {
+          method: "POST",
+          redirect: "error",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${credential}`,
+          },
+          body: JSON.stringify(request),
+          signal: signal ? AbortSignal.any([signal, deadline]) : deadline,
+        };
+        // Final expiry/request check is AFTER every awaited preparation. There
+        // must be no await between this durable admission and physical fetch.
+        const contract = authority.markDispatched(callId, request);
+        const response = await fetchImpl(contract.endpoint, options);
+        requireBudget(response.ok, "Provider HTTP response not successful");
+        const text = await boundedText(response, maximumResponseBytes);
+        let receipt;
+        if (request.stream === true) {
+          requireBudget(
+            response.headers.get("content-type")?.includes("text/event-stream"),
+            "Unexpected stream content type",
+          );
+          receipt = streamReceipt(text);
+        } else {
+          receipt = parseBudgetJson(text);
+          requireBudget(
+            receipt && !Object.hasOwn(receipt, "error"),
+            "Provider error envelope cannot settle",
+          );
+          requireBudget(
+            Array.isArray(receipt.choices) &&
+              receipt.choices.length === 1 &&
+              receipt.choices[0].index === 0 &&
+              ["stop", "length", "tool_calls"].includes(
+                receipt.choices[0].finish_reason,
+              ),
+            "Incomplete or multiple completion response",
+          );
+        }
+        const cost = authority.settle(callId, receipt);
+        settled = true;
+        return { body: text, streaming: request.stream === true, cost };
+      } catch {
+        if (!settled) {
+          // Do not persist provider errors which may contain credentials/content.
+          authority.markUnknown(
+            callId,
+            "transport or settlement outcome unknown",
+          );
+        }
+        throw budgetError(
+          "CC_BUDGET_TRANSPORT_UNKNOWN",
+          "Provider outcome unknown; reservation retained and further dispatch blocked",
+        );
+      }
+    },
+  });
+}

package/src/lib/goal-condition-engine.js

@@ -246,6 +246,16 @@ function whichLimitHit(state, budget, nowMs) {
  * the loop stops. Does NOT mutate `state` — returns the next one.
  */
 export function evaluateGoalStep(state, evaluation, budget, opts = {}) {
+  if (state.done === true) {
+    return {
+      state: { ...state },
+      decision:
+        state.outcome === "completed"
+          ? GOAL_DECISION.COMPLETE
+          : GOAL_DECISION.EXHAUSTED,
+      events: [],
+    };
+  }
   const nowMs = Number(opts.now ?? state.startedAtMs);
   const next = {
     ...state,
@@ -326,10 +336,23 @@ export class GoalConditionEngine {
 
   /** Accumulate a turn's usage before evaluating it. */
   recordTurnUsage({ tokens = 0, costUsd = 0 } = {}) {
+    if (
+      !Number.isSafeInteger(tokens) ||
+      tokens < 0 ||
+      typeof costUsd !== "number" ||
+      !Number.isFinite(costUsd) ||
+      costUsd < 0 ||
+      !Number.isSafeInteger(this.state.tokens + tokens) ||
+      !Number.isFinite(this.state.costUsd + costUsd)
+    ) {
+      throw new RangeError(
+        "Goal usage requires finite non-negative cost and safe token counts",
+      );
+    }
     this.state = {
       ...this.state,
-      tokens: this.state.tokens + (Number(tokens) || 0),
-      costUsd: this.state.costUsd + (Number(costUsd) || 0),
+      tokens: this.state.tokens + tokens,
+      costUsd: this.state.costUsd + costUsd,
     };
     return this.state;
   }

package/src/lib/llm-config-defaults.js

@@ -38,16 +38,18 @@ export async function reconcileConfigLlmProvider(cfgLlm = {}) {
   if (!cfgLlm || !cfgLlm.provider || !cfgLlm.baseUrl) {
     return { llm: cfgLlm, changed: false };
   }
-  const { inferProviderFromBaseUrl, modelForeignToProvider } =
-    await import("./runnable-provider.js");
+  const { inferProviderFromBaseUrl, modelForeignToProvider } = await import(
+    "./runnable-provider.js"
+  );
   const inferred = inferProviderFromBaseUrl(cfgLlm.baseUrl);
   if (!inferred || inferred === cfgLlm.provider) {
     return { llm: cfgLlm, changed: false };
   }
   const corrected = { ...cfgLlm, provider: inferred };
   if (modelForeignToProvider(inferred, cfgLlm.model)) {
-    const { selectModelForTask, TaskType } =
-      await import("./task-model-selector.js");
+    const { selectModelForTask, TaskType } = await import(
+      "./task-model-selector.js"
+    );
     const def = selectModelForTask(inferred, TaskType.CHAT);
     if (def) corrected.model = def;
   }
@@ -88,6 +90,8 @@ export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
     options.provider === cfgLlm.provider
   ) {
     if (!options.baseUrl && cfgLlm.baseUrl) options.baseUrl = cfgLlm.baseUrl;
+    if (options.serviceTier == null && cfgLlm.serviceTier != null)
+      options.serviceTier = cfgLlm.serviceTier;
     backfillApiKey(options, cfgLlm);
     if (!options.model && !opts.explicitModel && cfgLlm.model) {
       options.model = cfgLlm.model;
@@ -96,6 +100,8 @@ export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
   }
   if (options.provider || !cfgLlm.provider) return options;
   options.provider = cfgLlm.provider;
+  if (options.serviceTier == null && cfgLlm.serviceTier != null)
+    options.serviceTier = cfgLlm.serviceTier;
   if (opts.explicitModel) {
     options.model = opts.explicitModel;
   } else if (cfgLlm.model) {

package/src/lib/llm-pricing.js

@@ -67,6 +67,9 @@ export const PRICE_TABLE = Object.freeze({
         exact: true,
         terms: Object.freeze({
           ...GPT6_PRICING_TERMS,
+          ...(model.serviceMultipliers
+            ? { serviceMultipliers: model.serviceMultipliers }
+            : {}),
           ...(model.cacheReadMultiplier == null
             ? {}
             : { cacheReadMultiplier: model.cacheReadMultiplier }),
@@ -259,9 +262,16 @@ export function normalizePricingTerms(value) {
       Reflect.ownKeys(tiers).length === 0 ||
       Reflect.ownKeys(tiers).some(
         (key) =>
-          !["standard", "default", "auto", "batch", "flex", "fast"].includes(
-            key,
-          ) || !finite(tiers[key]),
+          ![
+            "standard",
+            "default",
+            "auto",
+            "batch",
+            "flex",
+            "fast",
+            "priority",
+            "ultrafast",
+          ].includes(key) || !finite(tiers[key]),
       )
     )
       fail();
@@ -378,7 +388,9 @@ export function estimateCost({
     ? Object.hasOwn(rate.terms.serviceMultipliers, serviceTier)
       ? rate.terms.serviceMultipliers[serviceTier]
       : null
-    : 1;
+    : ["standard", "default"].includes(serviceTier)
+      ? 1
+      : null;
   if (
     !rate ||
     tierMultiplier == null ||

package/src/lib/model-capabilities.js

@@ -263,6 +263,10 @@ export function resolveModelCapabilityProfile({
   const profile = {
     schema: PROFILE_SCHEMA,
     catalogVersion: MODEL_CAPABILITY_CATALOG_VERSION,
+    reviewedAt: documented ? documented.reviewedAt || "2026-10-05" : null,
+    supportedServiceTiers: documented?.serviceTiers
+      ? [...documented.serviceTiers]
+      : ["standard"],
     profileId: `model-capability-v1:${identityDigest.slice(7, 39)}`,
     provider: selectedProvider || "unknown",
     model: selectedModel,
@@ -288,3 +292,25 @@ export function resolveModelCapabilityProfile({
   profile.digest = canonicalDigest(profile, PROFILE_SCHEMA);
   return deepFreeze(profile);
 }
+
+/** Resolve a requested live tier without certifying account availability. */
+export function resolveModelServiceTier(profile, serviceTier) {
+  const requested = serviceTier ?? "standard";
+  if (
+    typeof requested !== "string" ||
+    !profile?.supportedServiceTiers?.includes(requested)
+  ) {
+    throw Object.assign(
+      new RangeError(
+        `Unsupported service tier ${String(requested)} for ${profile?.provider || "unknown"}/${profile?.model || "unknown"}`,
+      ),
+      { code: "CC_MODEL_SERVICE_TIER_UNSUPPORTED" },
+    );
+  }
+  return Object.freeze({
+    requestedServiceTier: requested,
+    requestServiceTier: requested === "standard" ? null : requested,
+    effectiveServiceTier: null,
+    accountVerified: false,
+  });
+}

package/src/lib/model-catalog-review.js

@@ -65,8 +65,12 @@ export function reviewModelCatalog(review, snapshots = {}) {
       "runtimeProtocol",
       "contextWindowTokens",
       "advertisedMaxOutputTokens",
+      "reviewedAt",
     ]) {
-      if (Object.hasOwn(expected, field) && actual[field] !== expected[field])
+      if (
+        Object.hasOwn(expected, field) &&
+        !isDeepStrictEqual(actual[field], expected[field])
+      )
         mismatches.push({
           model: expected.model,
           field,
@@ -80,6 +84,19 @@ export function reviewModelCatalog(review, snapshots = {}) {
         field: "official-source",
         actual: null,
       });
+    if (
+      Object.hasOwn(expected, "supportedServiceTiers") &&
+      !isDeepStrictEqual(
+        actual.supportedServiceTiers,
+        expected.supportedServiceTiers,
+      )
+    )
+      mismatches.push({
+        model: expected.model,
+        field: "supportedServiceTiers",
+        expected: expected.supportedServiceTiers,
+        actual: actual.supportedServiceTiers,
+      });
     for (const field of ["in", "out"]) {
       if (rate?.[field] !== expected.pricing[field])
         mismatches.push({

package/src/lib/model-context-catalog.js

@@ -45,7 +45,7 @@ export const CONTEXT_WINDOWS = Object.freeze({
   }),
 });
 
-export const MODEL_CAPABILITY_CATALOG_VERSION = "2026-10-05";
+export const MODEL_CAPABILITY_CATALOG_VERSION = "2026-10-15";
 
 // Explicit ownership prevents a model name served by an unrelated provider
 // from silently inheriting another provider's catalog window.
@@ -86,6 +86,26 @@ export const LEGACY_MODEL_PROVIDERS = Object.freeze({
 // named models, not endpoint access, account entitlement, or a live CLI run.
 export const DOCUMENTED_OPENAI_MODELS = Object.freeze({
   "gpt-6.1-sol": Object.freeze({
+    reviewedAt: "2026-10-15",
+    serviceTiers: Object.freeze([
+      "standard",
+      "default",
+      "auto",
+      "fast",
+      "priority",
+      "flex",
+      "ultrafast",
+    ]),
+    serviceMultipliers: Object.freeze({
+      standard: 1,
+      default: 1,
+      auto: 1,
+      batch: 0.5,
+      flex: 0.5,
+      fast: 2,
+      priority: 2,
+      ultrafast: 6,
+    }),
     contextWindowTokens: 1050000,
     advertisedMaxOutputTokens: 128000,
     requiresResponsesForTools: true,
@@ -106,6 +126,26 @@ export const DOCUMENTED_OPENAI_MODELS = Object.freeze({
     ]),
   }),
   "gpt-6-astra": Object.freeze({
+    reviewedAt: "2026-10-15",
+    serviceTiers: Object.freeze([
+      "standard",
+      "default",
+      "auto",
+      "fast",
+      "priority",
+      "flex",
+      "ultrafast",
+    ]),
+    serviceMultipliers: Object.freeze({
+      standard: 1,
+      default: 1,
+      auto: 1,
+      batch: 0.5,
+      flex: 0.5,
+      fast: 2,
+      priority: 2,
+      ultrafast: 6,
+    }),
     contextWindowTokens: 1050000,
     advertisedMaxOutputTokens: 128000,
     requiresResponsesForTools: true,

package/src/lib/openai-responses.js

@@ -1,3 +1,5 @@
+import { resolveModelServiceTier } from "./model-capabilities.js";
+
 const RESPONSES_FAILURE_CODE = "CC_OPENAI_RESPONSES_FAILED";
 const MAX_REASONING_ITEMS = 16;
 const MAX_REASONING_SUMMARY_CHARS = 8_192;
@@ -177,7 +179,12 @@ export function createOpenAIResponsesBody({
   reasoning = null,
   stream = false,
   modelProfile = null,
+  serviceTier = null,
 }) {
+  const tier =
+    serviceTier == null
+      ? null
+      : resolveModelServiceTier(modelProfile, serviceTier).requestServiceTier;
   if (
     modelProfile?.advertisedMaxOutputTokens != null &&
     maxOutputTokens > modelProfile.advertisedMaxOutputTokens
@@ -195,6 +202,7 @@ export function createOpenAIResponsesBody({
     ...(maxOutputTokens ? { max_output_tokens: maxOutputTokens } : {}),
     ...(reasoning ? { reasoning } : {}),
     ...(stream ? { stream: true } : {}),
+    ...(tier ? { service_tier: tier } : {}),
   };
 }
 

package/src/lib/skill-retrieval-router.js

@@ -248,6 +248,7 @@ export function routeSkillDescriptors({
     schema: SKILL_RETRIEVAL_RESULT_SCHEMA,
     query: query.trim(),
     selected: returned.length > 0 && !topConflict ? returned[0] : null,
+    matchedCount: candidates.length,
     candidates: Object.freeze(returned.map(Object.freeze)),
     conflicts: Object.freeze(conflicts.map(Object.freeze)),
     rejected: Object.freeze(rejected.map(Object.freeze)),

package/src/lib/usage-pricing-context.js

@@ -4,6 +4,38 @@ import {
   GPT6_PRICING_TERMS,
 } from "./model-context-catalog.js";
 
+const KNOWN_SERVICE_TIERS = new Set([
+  ...Object.keys(GPT6_PRICING_TERMS.serviceMultipliers),
+  ...Object.values(DOCUMENTED_OPENAI_MODELS).flatMap((model) =>
+    Object.keys(model.serviceMultipliers || {}),
+  ),
+]);
+
+/** Preserve response-envelope pricing labels, rejecting conflicting evidence. */
+export function projectEnvelopePricingContext(usage = {}, envelope = {}) {
+  const input = { ...usage };
+  for (const key of ["service_tier", "regional_processing", "inference_geo"]) {
+    if (!Object.hasOwn(envelope, key)) continue;
+    if (Object.hasOwn(input, key) && input[key] !== envelope[key])
+      input.pricingContextInvalid = true;
+    input[key] = envelope[key];
+  }
+  return projectUsagePricingContext(input);
+}
+
+/** Requested paid tiers require actual response evidence for settlement. */
+export function preserveRequestedServiceTierEvidence(usage, requested) {
+  if (
+    usage &&
+    requested != null &&
+    requested !== "standard" &&
+    (!usage.service_tier || usage.service_tier === "auto")
+  ) {
+    return { ...usage, pricingContextInvalid: true };
+  }
+  return usage;
+}
+
 /** Keep TTL evidence distinct from the aggregate cache-write count. */
 export function projectCacheCreationUsage(usage = {}) {
   if (usage.cacheCreationInvalid === true)
@@ -62,8 +94,7 @@ export function projectUsagePricingContext(usage = {}) {
     const value = Object.hasOwn(usage, key) ? usage[key] : usage[alias];
     if (key === "service_tier") {
       projected[key] =
-        typeof value === "string" &&
-        Object.hasOwn(GPT6_PRICING_TERMS.serviceMultipliers, value)
+        typeof value === "string" && KNOWN_SERVICE_TIERS.has(value)
           ? value
           : "unknown";
     } else {